Cloud Disk Snapshot Created for Data Exfiltration

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects when a cloud disk snapshot is created, specifically targeting AWS EC2 'CreateSnapshot' API calls. This activity can be indicative of data exfiltration attempts, where an attacker creates a snapshot of a compromised disk to move data out of the environment.